fix: add type safety to res.location to prevent encodeUrl crash#6947
fix: add type safety to res.location to prevent encodeUrl crash#6947ST4RKJR wants to merge 1 commit intoexpressjs:masterfrom
Conversation
|
Hi maintainers 👋 |
|
So now invalid inputs will be quietly ignored without a trace? That doesn't sound like a good idea. While I understand that getting errors is annoying, it is much easier to debug problems if they are clearly signalled. |
9d7347e to
d007023
Compare
Thanks for the feedback! You're right — silently coercing invalid values Happy to adjust further if needed! |
d007023 to
af9bfbd
Compare
|
Thanks for the feedback — the previous version was too strict and didn't
This now aligns with the expectations in test/res.location.js. |
bjohansebas
left a comment
There was a problem hiding this comment.
Thanks for your contribution, but we already have another PR (#6404) ready for this change, which will be released for Express v6. It's not necessary to add tests for a deprecation
Also, please don’t make style changes
res.location()currently passes the value directly intoencodeUrl(url).If
urlis not a string (e.g., null, undefined, numbers, objects), thiscauses a TypeError and crashes the response.
This PR adds a small input guard that normalizes the value using
String(url ?? ''), ensuringencodeUrlalways receives a valid stringand preventing runtime crashes.
This is a code-only, backward-compatible safety improvement.